Ransomware prevention still fails where identity and backups break

At a glance

What this is: This guide explains how ransomware typically progresses from initial access to encryption, and finds that recovery failures often stem from weak identity controls and untested backups.

Why it matters: It matters because IAM, PAM and recovery teams need to treat ransomware as an access, resilience and governance problem, not only a malware problem.

By the numbers:

• Companies with an F rating are 13.8x more likely to suffer a data breach than those with an A rating.

Context

Ransomware is not just file encryption. It is an access path, an execution path and a recovery failure all at once, which is why traditional malware-centric controls often miss the real governance gaps. In identity terms, the attack succeeds when phishing, credential abuse, privilege escalation and backup access are all weak enough to let the operator move from entry to recovery suppression.

The article’s primary lesson is that ransomware resilience depends on the integrity of identity controls around users, administrators, service access and backup systems. Where those controls are fragmented, attackers can take over the environment, disable defences and leave recovery paths unusable. That makes ransomware a cross-functional issue for IAM, PAM, security operations and backup owners, not only endpoint teams.

Key questions

Q: What breaks when ransomware attackers can reach backup systems and email archives?

A: When attackers can reach backup systems and email archives, the breach stops being a single data loss event and becomes a full intelligence harvest. Historical mail, backups, and recovery stores often contain credentials, org charts, and sensitive context that support follow-on phishing, impersonation, and broader extortion.

Q: Why does ransomware create more risk when privilege boundaries are weak?

A: Weak privilege boundaries let an initial foothold turn into domain-wide access. Once attackers can move laterally, they can disable security tools, find backup infrastructure and expand the blast radius from one infected endpoint to the wider environment.

Q: How do security teams measure whether ransomware resilience is actually improving?

A: Resilience improves when organisations can detect privileged misuse quickly, revoke access without delay, and isolate affected systems before ransomware spreads. Useful signals include time to detect anomalous access, time to disable compromised accounts, and the percentage of critical systems protected by tested recovery controls. If those measures stay slow, the programme is still vulnerable.

Q: How should organisations respond when ransomware operators combine encryption with data theft and leak-site extortion?

A: Security teams should treat modern ransomware as an extortion campaign, not just an encryption event. That means prioritising containment, evidence preservation, legal coordination, and rapid validation of what data may have been stolen. When attackers can publish data if payment is not made, response plans must include customer, regulatory, and operational decision points, not only restoration from backups.

Technical breakdown

How ransomware turns initial access into control

Ransomware campaigns usually begin with phishing, exploited vulnerabilities or stolen credentials, then pivot into reconnaissance and privilege escalation. The malware or operator maps the environment, identifies backup servers, domain controllers and shared resources, and then uses legitimate administration tools to blend into normal traffic. That matters because the attack is not a single binary event. It is a sequence that depends on identity trust, reachable assets and weak segmentation.

Practical implication: reduce the number of accounts and paths that can reach backup and admin infrastructure.

Why backup deletion is part of the attack chain

Modern ransomware operators often delete shadow copies, disable security tools and target backup repositories before encryption starts. That step removes the victim’s best recovery option and turns an availability incident into a negotiation pressure tactic. Backups that exist on paper but are still online, writable or reachable through the same credential set are part of the attack surface, not a separate control layer.

Practical implication: treat backup access, backup immutability and restore testing as security controls, not storage tasks.

How double extortion changes the risk model

Double extortion combines encryption with data theft, so the attacker can threaten both operational downtime and public disclosure. That shifts the decision from restoring files to managing business, legal and reputational pressure at the same time. Once exfiltration happens, the organisation is no longer only defending data availability. It is also managing the identity and access conditions that allowed the data to be reached in the first place.

Practical implication: pair exfiltration detection with access review for privileged and third-party accounts.

Threat narrative

Attacker objective: Force payment by denying access to systems and data while preserving enough leverage through stolen information and disabled recovery paths.

1. Entry typically begins through phishing, malicious links or compromised credentials that give the attacker a foothold in the environment.
2. The attacker escalates privileges, disables protections and identifies backup systems, domain controllers and shared drives that can be used to maximise impact.
3. Before encryption, the attacker may steal sensitive data and delete recovery points so the victim loses both availability and leverage.
4. The final objective is to encrypt business data, extort payment and pressure the organisation with both downtime and exposure threats.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Ransomware is really an identity failure wrapped in malware. The article’s stages only work when attackers can move from one trusted account or system relationship to the next. That is why phishing resistance, credential scope and privilege boundaries matter as much as endpoint detection. Practitioners should treat ransomware as an access-governance problem with malware as the payload.

Backup resilience collapses when backup systems are governed like ordinary infrastructure. If the same admin paths, credentials or network reachability protect production and backup assets, ransomware operators can sabotage recovery before encryption even completes. This is the classic standing recovery privilege problem, and it deserves the same discipline as production PAM. Practitioners should separate recovery control planes from routine operational access.

Double extortion creates a governance gap that many recovery plans still underestimate. Once data theft precedes encryption, restoration alone is not a full response because disclosure risk persists after systems come back online. That means incident preparation must join identity review, data exposure assessment and legal escalation into a single playbook. Practitioners should assume the attacker is targeting both availability and trust.

Ransomware prevention now depends on a control stack that spans users, workloads and backup identities. The article implicitly shows why password hygiene alone is insufficient when administrative accounts, service accounts and backup interfaces can all be abused in sequence. IAM and PAM teams need to own the paths that connect initial access to restoration failure. Practitioners should map those paths as one attack surface.

What this signals

Ransomware prevention fails when identity and recovery are governed as separate problems. The article shows that attackers exploit the handoff points between user access, administrative privilege and backup control. Security teams should therefore design ransomware defences around the full access path, not isolated technical controls.

Standing recovery privilege is a blind spot in many backup programmes. If backup operators, admin tools and restore servers share the same trust model as production, attackers can remove recovery before defenders can use it. Practitioners should assume backup infrastructure is part of the target set, not a passive asset.

Double extortion makes access review a post-breach issue as well as a preventive one. Once attackers steal data, the question becomes which identities were able to reach it and whether those paths were necessary. That pushes IAM, PAM and incident response into the same operating model for ransomware cases.

For practitioners

• Harden access to backup systems Remove routine administrator access from backup repositories, restore servers and snapshot management consoles. Use separate privileged accounts, restricted network paths and strong approval workflows for any change that can delete or overwrite recovery data.
• Test restores under hostile conditions Run restore tests that assume backup files may be partially unavailable, credentials may be compromised and production systems may be isolated. Measure whether critical services can return without relying on the same identity paths used during normal operations.
• Constrain lateral movement routes Segment domain controllers, file shares and administrative tools so one compromised account cannot reach the entire environment. Limit PowerShell, WMI and other living-off-the-land paths to approved admin workflows only.
• Review privileged and third-party access Reassess which service providers, support accounts and internal administrators can reach sensitive data repositories. Remove standing access that is not required for business continuity and validate that offboarding revokes every recovery-relevant path.
• Link exfiltration alerts to ransomware response Treat large file transfers, unusual off-hours access and new external connections as potential pre-encryption signals. Feed those alerts into incident response so data theft and encryption are investigated as one campaign.

Key takeaways

• Ransomware is effective because it exploits identity trust, segmentation gaps and weak recovery governance before it ever finishes encryption.
• The article’s evidence shows that organisations with weaker security ratings face materially higher breach likelihood, which is a warning sign for recovery readiness.
• The most important defensive shift is to separate administrative access, backup control and restoration paths so one compromise cannot erase the recovery option.

Key terms

• Double-extortion ransomware: A ransomware model where attackers both encrypt systems and threaten to publish stolen data. In healthcare, this increases pressure because restored services do not erase privacy, fraud, or regulatory damage caused by the data theft itself.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Recovery-Path Privilege: Recovery-path privilege is the practical authority embedded in password reset, lockout recovery, and contact-change workflows. When these flows are weak, they function like privileged access because whoever controls them can often regain or maintain account control without defeating the primary login controls again.
• Living-off-the-Land: Living-off-the-land attacks use legitimate enterprise tools instead of custom malware. In identity environments, that means abusing approved administrative functions to perform disruptive actions while blending into normal operational traffic.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps identity and security practitioners align access, privilege and lifecycle controls with operational resilience.